REPO_POLICIES: script/ entrypoints are the source of truth (closes #155)

The rule against invoking tools directly now names the script/ scripts
as the single source of truth and allows calling them directly. The
Makefile targets must still exist as thin shims. The one-package
go test exception is unchanged.

Model: opus-5-5

prompts/REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-11-04
+last_modified: 2026-11-06
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -199,14 +199,15 @@ style conventions are in separate documents:
     README must document the provided scripts in an **Entrypoints** section (see
     the README requirements below).
 
-- Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
-  instead of invoking the underlying tools directly. The Makefile is the single
-  source of truth for how these operations are run.
+- Run the repo's own entrypoints, never the underlying tools directly. The
+  `script/` scripts are the single source of truth for how each operation runs.
+  Calling them directly is fine, and so is calling the Makefile targets. The
+  Makefile targets must still exist, as the thin shims described above.
 
     An agent whose work is confined to one package may run `go test` directly on
     that package's suite, or on individual tests in it, while iterating. This is
     the only exception to this rule. `go build`, `go vet` and the linter still
-    go through make targets. A run while iterating is not a gate, so the full
+    go through the entrypoints. A run while iterating is not a gate, so the full
     `make check` is still required before every push.
 
 - The Makefile is authoritative documentation for how the repo is used. Beyond